From: Adel-Ayoub Date: Fri, 3 Jul 2026 16:47:50 +0000 (+0100) Subject: crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checks X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=05b65fcb223cd3d899b595d3ec798e134f5f36d6;p=thirdparty%2Fopenssl.git crypto/pkcs12/p12_decr.c: fix EVP_CIPHER_CTX_ctrl error checks EVP_CIPHER_CTX_ctrl() reports failure of the EVP_CTRL_AEAD_TLS1_AAD and EVP_CTRL_AEAD_SET_TAG controls as 0, not as a negative value, so the "< 0" checks on the cipher-with-MAC path cannot detect any failure. A return of 0 means a failed or unsupported control, or for EVP_CTRL_AEAD_TLS1_AAD a zero MAC length, none of which is usable here. Change both checks to "<= 0", matching the EVP_CTRL_AEAD_GET_TAG check fixed by commit 674c23d2656e in this function. Follow-up to https://github.com/openssl/openssl/pull/30923. Fixes: ea0add4a8227 "New GOST PKCS12 standard support" CLA: trivial Reviewed-by: Dmitry Belyavskiy Reviewed-by: Andrew Dinh Reviewed-by: Jakub Zelenka MergeDate: Mon Jul 27 10:21:13 2026 (Merged from https://github.com/openssl/openssl/pull/31848) --- diff --git a/crypto/pkcs12/p12_decr.c b/crypto/pkcs12/p12_decr.c index 535481cdfe7..5b51f69027c 100644 --- a/crypto/pkcs12/p12_decr.c +++ b/crypto/pkcs12/p12_decr.c @@ -57,7 +57,8 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor, if ((EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx)) & EVP_CIPH_FLAG_CIPHER_WITH_MAC) != 0) { - if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len) < 0) { + if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_TLS1_AAD, 0, &mac_len) + <= 0) { ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR); goto err; } @@ -72,7 +73,7 @@ unsigned char *PKCS12_pbe_crypt_ex(const X509_ALGOR *algor, inlen -= mac_len; if (EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, (int)mac_len, (unsigned char *)in + inlen) - < 0) { + <= 0) { ERR_raise(ERR_LIB_PKCS12, ERR_R_INTERNAL_ERROR); goto err; }